# syntax=docker/dockerfile:1.7

# Override these in CI with immutable digests when you are ready to pin them fully.
ARG GO_IMAGE=golang:1.26.2-alpine3.22
ARG RUNTIME_IMAGE=gcr.io/distroless/static-debian12:nonroot

FROM ${GO_IMAGE} AS build-base

WORKDIR /src

ENV CGO_ENABLED=0 \
    GOOS=linux \
    GOFLAGS=-buildvcs=false

COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    go mod download && go mod verify

FROM build-base AS healthcheck-build

COPY cmd/healthcheck/ ./cmd/healthcheck/
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    go build \
        -trimpath \
        -ldflags="-s -w" \
        -o /out/healthcheck \
        ./cmd/healthcheck

FROM build-base AS worker-build

COPY cmd/worker/ ./cmd/worker/
COPY internal/ ./internal/
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    go build \
        -trimpath \
        -ldflags="-s -w" \
        -o /out/wucher-worker \
        ./cmd/worker
RUN mkdir -p /out/.local/emails && touch /out/.local/emails/.keep

FROM build-base AS file-worker-build

COPY cmd/worker/ ./cmd/worker/
COPY internal/ ./internal/
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    go build \
        -trimpath \
        -ldflags="-s -w" \
        -o /out/wucher-file-worker \
        ./cmd/worker

FROM build-base AS api-build

ARG VERSION=unknown
ARG COMMIT=unknown
ARG BUILD_TIME=unknown

COPY cmd/api/ ./cmd/api/
COPY internal/ ./internal/
COPY docs/docs.go ./docs/docs.go
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    go build \
        -trimpath \
        -ldflags="-s -w -X 'wucher/internal/buildinfo.Version=${VERSION}' -X 'wucher/internal/buildinfo.Commit=${COMMIT}' -X 'wucher/internal/buildinfo.BuildTime=${BUILD_TIME}'" \
        -o /out/wucher-api \
        ./cmd/api

FROM ${RUNTIME_IMAGE} AS runtime-base

WORKDIR /app

FROM runtime-base AS worker

COPY --from=healthcheck-build --chown=nonroot:nonroot /out/healthcheck /app/healthcheck
COPY --from=worker-build --chown=nonroot:nonroot /out/wucher-worker /app/wucher-worker
COPY --from=worker-build --chown=nonroot:nonroot /out/.local/emails/ /app/.local/emails/

ENV WORKER_JOB=email

USER nonroot:nonroot

ENTRYPOINT ["/app/wucher-worker"]

FROM runtime-base AS file-worker

COPY --from=healthcheck-build --chown=nonroot:nonroot /out/healthcheck /app/healthcheck
COPY --from=file-worker-build --chown=nonroot:nonroot /out/wucher-file-worker /app/wucher-file-worker

ENV WORKER_JOB=file_processing

USER nonroot:nonroot

ENTRYPOINT ["/app/wucher-file-worker"]

FROM runtime-base AS api

COPY --from=healthcheck-build --chown=nonroot:nonroot /out/healthcheck /app/healthcheck
COPY --from=api-build --chown=nonroot:nonroot /out/wucher-api /app/wucher-api

USER nonroot:nonroot

EXPOSE 8080

ENTRYPOINT ["/app/wucher-api"]